To ensure that your data is processed correctly, we have adopted the following principles:We only collect and process your personal data if we have a legal basis for the processing pursuant to existing legislation, e.g.:• We have your permission (your consent)• It is necessary to observe an agreement with you• We are under legal obligation to do so

We will always inform you of the processing and its purpose, unless (and only in specific circumstances) we have a legitimate basis for not doing it. By "processing", we mean our collection, use, disclosure, storage and eventually deletion of your data.We do not disclose your personal information to other people or companies outside the LEGO® Group, unless you have given us your consent, or unless we are under legal obligation to do so. For more details, see section 5.As we are obligated to update our personal data, we will continuously ensure that your data processed by us is correct and updated.We might choose to add information from other databases to your personal data to ensure that your information is correct and updated.We do not store your personal data longer than necessary to serve the purpose for which they are processed.

3. Collection of Personal Data

You will always be informed if we collect personal data about you. The personal data collected by us may include, for instance, your name, email address, home address, phone number and similar identification data, including information about your navigation on the website.

We also collect your personal data when you interact with us on our various programmes and websites. Here we will present you with specific terms telling you which specific information that might be collected and for which purpose.In general, we typically process the following categories of personal data:• Contact details when you contact us via email or phone

• Information you provide in public fora on our websites and programmes

• Information you provide when you use our websites and programmes, our programmes on third party websites or third-party platforms such as social networks

4. Why and how We Process your Personal Data

We collect and use your personal data to reply to your inquiry, including applications for donations. We also process the personal data, you provide, when you participate in public fora or other activities on our websites and programmes or in other ways interact with us. Remember that when you provide personal data to us on third-party websites or platforms (e.g. via our programmes or via social media), the personal data, you provide, may be processed individually by the third-party websites or by the owner of the platform. The personal data we process is comprised by this Privacy Policy, whereas the personal data the third-party website or platform process is subject to the personal data principles of that third-party website or platform. The choice you have made in relation to confidentiality on the third-party website or platform does not apply to our use of personal data that we have processed directly via our websites, channels or programmes.We process your personal data via special technology, e.g. cookies when you visit our websites, channels or programmes via third party websites or platforms.View our Cookie Policy for further information cf. item 8. 5. How we use your personal data within the LEGO Group companies

LEGO Fonden is located in Billund and is the data controller. For more details about the LEGO Group and its subsidiaries, please visit http://www.lego.com/aboutus/lego-group/locations. Other companies within the LEGO Group may have access to your information if they carry out services on behalf of LEGO Fonden (as data processing entity) and, unless this is illegal according to existing legislation, for their own use (as data controlling entity) for the following purposes: • To provide products and services you request, e.g. donations

• To register, examine and prevent activities that might violate our policies or be illegal

6. Sharing of personal data with other data controllers

We do not share your personal data outside the LEGO® except in limited cases, such as:• If necessary and only to the extent necessary to handle your inquiry, or if you have given your consent

• To observe statutory rules or otherwise if we believe that forwarding is required by law, e.g. to observe a writ of summons or a similar legal process;

• To observe an agreement with you

7. Your rightsYou are at any time entitled to access the personal data, we process about you, but with certain legislative exceptions. You also have the right to object to the collection and further processing of your personal data including profiling/automated decision-making. Furthermore, you have the right to have your personal data rectified, erased, or blocked according to the rules. Moreover, you have the right to receive information about you that you have provided to us, and the right to have this information transmitted to another data controller (data portability).

8. Cookies

We use cookies on our website. You can read more about the use of cookies in our Cookie Policy which you can find on the following link.

9. Deletion of personal data

We delete your personal data when we no longer need to process them in relation to one or more of the purposes mentioned in item 4. However, the data may be processed and stored for a longer period in anonymized form.

10. Data security and integrity

The security, integrity and confidentiality of your personal data is very important to us. We have established technical, administrative, and physical precautionary measures that are intended for protecting personal information from unauthorised access, transfer, use and change.

11. Data transfer, storage, and processing globally

LEGO Fonden and other LEGO Group companies operate globally. The LEGO Fonden may transfer or leave your personal information to individual companies within the LEGO Group or to third parties all over the world for the purposes stated in this Privacy Policy. If your personal information is transferred, stored, or processed by us or other companies conducting such services on our behalf, we will take reasonable precautionary measures to ensure the confidentiality of your personal information.

12. Changes to this Privacy Policy

We continually update this Privacy Policy to ensure that we give you as precise information as possible as well as to ensure that we comply with current legislation.

13. Links to other websites, etc.Our website may contain links to other websites or to integrated sites. We are not responsible for the contents of the websites of other companies or for the practices of such companies regarding the collection of personal data. When you visit other websites, you should read the owners' policies on the protection of personal data and other relevant policies.

14. Contact detailsIf you want us to update, change or delete the personal data, we have recorded about you, wish to get access to the personal data being processed about you, or if you have questions concerning above guidelines, you may contact us at the following address/phone/mail:LEGO FondenKoldingvej 27190 BillundCVR-nr.: 12458339 Email: LEGOfoundation@lego.com

15. ComplaintsIf you wish to appeal against the processing of your personal data, please contact us by email, telephone or letter as indicated in section 14 above. You may also contact the Data Protection Agency, Borgergade 28, 5., 1300 Copenhagen K.